The If‑So Dynamic Content plugin contains a stored cross‑site scripting vulnerability that is triggered through the "repeater" parameter family, including fields such as version_uid and other sibling attributes. The plugin fails to sanitize input or escape output for these fields, allowing an attacker who can log in with contributor or higher privileges to inject arbitrary JavaScript that will be persisted in the database and executed whenever an affected page is viewed. This flaw could lead to session hijacking, defacement, or the execution of further malicious code by downstream visitors.

The vulnerability affects the If‑So Dynamic Content – Elementor & All Page Builders Personalization WordPress plugin in all versions up to and including 1.10.2. All installations that rely on this plugin and permit contributor‑level access are at risk.

With a CVSS score of 6.4, the flaw represents a medium‑severity risk. The exploit probability is not quantified by EPSS, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is that an authenticated attacker, using a contributor or higher role, submits malicious input through the plugin’s UI, which is then stored and later rendered as part of a page. Once exploited, the attacker can perform whatever actions the compromised user can, including cookie theft and session fixation, which may extend to higher‑privilege accounts through social engineering or follow‑on exploits.